Updates

September 2026

What changed this month, and what it means for your risk.

Four developments from New York's financial regulator, CISA, NIST and six national cyber agencies. One is a regulator saying what examiners will look for, and one sets a hard deadline for every Microsoft 365 customer. Together they make one point: a risk decision is only as good as the data under it, and most of that data is about what you own and who can sign in.

Talk it through with us Read the updates

Edition 1Published September 2026Read time 4 minutes

This month's theme

Good risk decisions start with good data.

A risk assessment that misses part of your environment, a vulnerability list built on incomplete records, sign-ins you can't fully see. Each one makes the decision on top of it wrong before anyone reads it. This month, a regulator, CISA, NIST and six national agencies each pushed on a different part of that data.

01NYDFS guidance on risk assessmentsWhat examiners expect, and the gaps they keep findingRisk management
02CISA's CVE Quality Era frameworkVulnerability data you can trust, in a record monthVulnerability management
03Joint guidance on Active Directory compromiseHow attackers take the keys, and how to spot itIdentity hardening
04NIST IR 8587 and the Entra passkey changeProtecting the tokens behind every sign-inM365 hardening

Risk management

New York spells out how risk assessments should actually work.

NYDFS issued guidance on how to run and use the risk assessment its cybersecurity regulation requires, and listed the gaps its examiners keep finding.

What it is

An industry letter to the banks, insurers and other firms NYDFS licenses. It expects an assessment built on a current inventory of assets and data, a repeatable method with consistent ratings for likelihood and impact, and coverage of suppliers, new technology and single points of failure. It should be reviewed and updated as reasonably necessary, at least once a year, and whenever a change in the business or its technology materially changes cyber risk; a merger or a system migration may qualify. It creates no new obligations, but it shows how examiners will read the existing ones.

Why it matters for risk

Part 500 says the security program must be based on the risk assessment. So examiners can ask you to show how the risks you identified drive your controls, your budget and the risks you chose to accept. The first two weaknesses on the NYDFS list are the basics: incomplete asset visibility and inconsistent methods. Firms outside New York should read it too. It is one of the clearest statements from any regulator of what a good assessment looks like.

Potential impact

Exam findings on the basics. An outdated inventory or a missing cloud environment undermines every rating built on it, and examiners now have a written list that says so.
Spending you can't defend. A control or a budget line that can't be traced to an identified risk is hard to justify to an examiner or a board.
Risk accepted by nobody. A risk with no named owner and no documented decision looks like a risk the firm ignored.
Aimed at last year's business. A merger, a new core system or a major outsourcing that doesn't trigger an update leaves the program protecting a company that no longer exists.

Questions to ask your team

Is our asset and data inventory complete enough to support the ratings in our risk assessment?
Do we separate inherent risk from residual risk, and can we show which controls make the difference?
For each major risk, can we name its owner and the decision we made about it?

How we help

Data Governance & Classification → Risk Assessment → NYDFS Part 500 → Risk Methodology → Board Presentations →

Vulnerability management

CISA moves the vulnerability catalog from volume to quality.

In the month Microsoft fixed close to 1,000 vulnerabilities in a single Patch Tuesday, CISA published a framework to make the records behind them more reliable.

What it is

The CVE Program assigns the identifiers that every scanner, vendor advisory and patch report relies on. CISA's framework says the program is leaving its growth era for a quality era. It defines quality in four areas: how the program is governed, who takes part, the systems that run it, and the content of each record. September's Patch Tuesday showed why: it was Microsoft's largest on record, with two flaws already being exploited.

Why it matters for risk

Most vulnerability programs treat a scanner result as a fact. But the record behind it can be incomplete: wrong affected versions, missing details, no exploitation data. Ranking that by CVSS score only puts the errors in order. CISA already moved federal agencies away from CVSS-only deadlines in June (BOD 26-04), toward whether a flaw is exploited, reachable from the internet and easy to automate. That is a good model for any organization.

Potential impact

Effort on the wrong fixes. Teams patch high-score flaws on internal systems while an exploited one on an internet-facing system waits its turn.
"Unknown" treated as "low". A finding with missing data quietly drops down the list instead of being flagged for a closer look.
Numbers the board can't trust. A count of open vulnerabilities says little about risk when the records under it are unreliable.
Always behind. At close to 1,000 fixes in one month, a team without a way to rank by real risk will never catch up.

Questions to ask your team

How do we decide what to patch first: CVSS score alone, or exploitation, exposure and business importance?
Do we flag findings with missing or conflicting data, or do they default to low priority?
Which vulnerability metric do we show leadership, and does it measure risk or just volume?

How we help

Vulnerability Management → Vulnerability Scanning → Risk Methodology → Board Presentations →

Identity hardening

Six agencies update the playbook for Active Directory attacks.

CISA, NSA and the national cyber agencies of Canada, Australia, New Zealand and the UK updated their joint guidance on how attackers take over Active Directory, and how to stop and spot each technique.

What it is

Active Directory decides who can sign in to what across most Windows networks. The guidance walks through the common ways attackers compromise it, such as cracking service account passwords, password spraying and abusing privileged accounts, and pairs each one with fixes and the events to watch for. The September update adds a section on shadow credentials, a quiet way to take over an account, and a new way to detect DCSync, where an attacker poses as a domain controller to copy password data.

Why it matters for risk

Whoever controls Active Directory controls nearly everything connected to it, often including the link to Microsoft 365. That is why ransomware crews go after it. A September study of 22 smaller organizations found the same pattern again and again: an exposed asset led to stolen credentials, which led to unauthorized access. A list of misconfigured settings doesn't show leadership that chain. An attack path does.

Potential impact

The whole network at once. One domain takeover can let attackers encrypt every server on the same night.
Weeks to rebuild. After a full compromise, recovery can mean rebuilding Active Directory itself, while the business waits.
Attackers who survive the cleanup. Shadow credentials can outlast a password reset, so attackers stay in after you think they are gone.
Findings fixed in the wrong order. A report with hundreds of settings, not grouped by attack path, rarely gets the dangerous ones done first.

Questions to ask your team

When did we last test how an attacker could get from an ordinary account to domain admin?
Are our admin and service accounts separated from everyday accounts, with strong, managed passwords?
Would we notice DCSync or a change to an account's sign-in keys today?

How we help

Vulnerability Management → M365 Security Implementation → Vulnerability Scanning → IR Tabletop Exercises → BCP / DR Plans →

M365 hardening

Protect the sign-in, not just the password.

NIST and CISA finalized guidance on protecting the tokens that keep people signed in to cloud services. The same month, Microsoft made passkeys the default way to sign in to Entra ID.

What it is

Once you sign in, a cloud service hands your browser or app a token: a digital pass that proves who you are without asking again. NIST IR 8587 tells cloud providers and their customers how to protect the keys that sign those tokens, check tokens properly and control how long they last. Microsoft's change is the user side of the same problem. Since September 1, users who rely on text or voice codes are prompted to register a passkey, and Microsoft's own text and voice codes end on February 1, 2027.

Why it matters for risk

Attackers increasingly skip the password. They steal a token from a laptop or a fake sign-in page, or, in the attack NIST points to, forge tokens with a stolen signing key, which let them take more than 60,000 emails from one government agency. Multi-factor authentication doesn't help once the token is gone. Passkeys stop the phishing behind many of these thefts. Text codes don't.

Potential impact

Mailbox takeover, no password needed. A stolen session token hands an attacker the mailbox, and with it the invoices and payment instructions.
A rush on the help desk. Users still on text codes are being prompted for passkeys, and many will call for help if nobody prepared them.
A February surprise. After February 1, keeping text codes means paying a telecom partner through Microsoft, and users who haven't switched get stuck at sign-in.
Supplier risk you can't see. Much of token security sits with your cloud and software providers, so their practices become your exposure.

Questions to ask your team

How many of our users still sign in with text or voice codes, and what is our plan before February 1?
How long do our Microsoft 365 sessions stay valid, and how fast can we revoke them after a suspected compromise?
Do we ask our key cloud providers how they protect the keys that sign our tokens?

How we help

M365 Security Implementation → M365 Policy Management → IR Tabletop Exercises → Control Standards →

Past updates

November 2026: AI agents just became an identity problem

Updates summarize public guidance in our own words and link to the original source. They are for awareness, not legal or compliance advice. If you want to know how any of this applies to your organization, ask us.

Where to start

Not sure which of these matters to you?

That's what a risk methodology is for. Once we know what your business can't afford to lose, each new piece of guidance either moves your risk or it doesn't, and you can tell which in minutes.

See the Risk Methodology

What changed this month, and what it means for your risk.

Good risk decisions start with good data.

New York spells out how risk assessments should actually work.

What it is

Why it matters for risk

Potential impact

Questions to ask your team

CISA moves the vulnerability catalog from volume to quality.

What it is

Why it matters for risk

Potential impact

Questions to ask your team

Six agencies update the playbook for Active Directory attacks.

What it is

Why it matters for risk

Potential impact

Questions to ask your team

Protect the sign-in, not just the password.

What it is

Why it matters for risk

Potential impact

Questions to ask your team

Not sure which of these matters to you?

Want to know what this means for you?